java servlet中是否可以准确确定客户端的IP地址
我想将网络中的一台计算机配置为接受来自特定计算机的所有呼叫，而无需进行身份验证。为此，我计划使用客户端计算机的 IP 地址作为所需的信任因素，以允许未经检查的身份验证。
我担心的是，是否可以在java servlet中准确确定客户端的IP地址？我在 servlet 中获得的 IP 是否有可能通过某种黑客机制进行更改，使我的服务器相信它是受信任的 IP？
例如，如果我的服务器计算机配置为信任 192.168.0.1，那么除 192.168.0.1 之外的其他客户端是否有可能冒充 192.168.0.1 并欺骗我的身份验证机制？
I want to configure a machine in my network to accept all calls from a specific machine without authentication. For this I am planning to use the IP address of the client machine as the required trust factor to allow unchecked authentication.
My concern is that is it possible to accurately determine the IP address of a client in a java servlet? Is it possible that the IP which I get in the servlet can be changed by some hacking mechanism to made my server to believe that it is the trusted IP?
For example if my server machine is configured to trust 192.168.0.1, then is it possible by some other client other than 192.168.0.1 to pretend as 192.168.0.1 and fool my authentication mechanism?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您可以使用
HttpServletRequest类中的getRemoteAddr()方法来获取 IP 地址。不过要小心。如果您的客户端位于代理服务器（甚至是 NATting 防火墙）后面，您将获得代理 IP 地址。因此，您还可以查找 X-Forwarded-For HTTP 标头（用于识别 HTTP 代理后面的客户端源 IP 地址的标准）。有关更多信息，请参阅维基百科。不过要小心。如果您的客户端不在代理后面，您可以获得空的 XFF 标头。因此，如果您要遵循此路径，则应该混合使用 servlet 方法和 XFF 标头评估。但是，不能保证代理会向您转发标头。
但请注意，源 IP 地址很容易被任何恶意客户端更改或伪造。我真的建议使用某种客户端身份验证（例如证书）。 Web 应用程序无法准确确定客户端 IP 地址。
You can use the
getRemoteAddr()method from theHttpServletRequestclass to obtain the IP address. Be careful, though. If your client is behind a proxy server (or even a NATting firewall), you'll get the proxy IP address instead.So, you can also look for the X-Forwarded-For HTTP header (standard for identifying the source IP address of a client behind an HTTP proxy). See more on Wikipedia. Be careful, though. If your client is NOT behind a proxy, you can get a null XFF header. So, if you are to follow this path, you should use a mix of the servlet methods and XFF header evaluation. There is no guarantee, though, that the proxy will forward you the header.
But be aware that the source IP address can be easily changed or faked by any malicious client. I really recommend using some sort of client authentication (a certificate, for example). There is no way for a web app to accurately determine the client IP address.
您的服务可能容易受到IP欺骗的攻击。伪造看似来自不同 IP 地址的数据包很容易。然而，欺骗的问题是攻击者将无法收到任何响应数据包。因此，如果调用您的服务不会导致内部状态更改（即它是只读的），那么您应该没问题。但是，如果对您的服务的调用将发出写入，那么您不应仅仅依赖 IP 地址，因为欺骗数据包足以更改系统的内部状态。
Your service could be vulnerable to IP Spoofing. It's easy to forge packets that appear to be from a different IP address. The thing about spoofing, though, is that the attacker won't be able to receive any response packets. Therefore, if calling your services doesn't cause an internal change of state (i.e. it's read only), then you should be okay. If, however, the calls to your service will issue writes, then you shouldn't rely simply on IP address because a spoofed packet will be enough to change the internal state of your system.
您可能在本地容易受到 ARP 欺骗的影响。恶意机器诱使路由器将 IP 地址与其 MAC 地址关联起来。
信任的级别和机制实际上取决于您试图保护的服务器/服务的敏感性以及您正在运行的环境。
在我看来，这是给定私有 IP 地址 192.168 范围的本地安排。如果该服务器不是面向公众的，不是关键的，并且您正在一个相对安全的 LAN 环境中运行，该环境与公共和其他私有 LAN 完全隔离，那么您应该没问题。否则，您应该考虑更高级别的其他安全选项。
You could be locally susepitable to ARP Spoofing. Where a malicious machine convinces the router to associate the IP address with it's MAC address.
The level and mechanism of trust really depends on the sensitivity of the server/service you are trying to protect and the environment you are operating in.
It looks to me that this is a local arrangement given the private IP address 192.168 range. If this server is not public facing, not critical and you are operating in a relatively secure LAN environment that's well shut off from the public and other private LANS then you should be OK. Otherwise you should look at other security options at a higher level.
不，这是不可能的。在许多情况下，由于用户的操作或用户无法控制的其他原因，您将看不到真实的客户端 IP 地址。
在后一种情况下，基于 IP 的识别最终会让诚实的客户感到头疼。即您真正想保留的客户。
如果您确实需要限制对特定计算机组的访问，您应该考虑使用 SSL/TLS 之类的客户端证书作为您的第一道防线。 此处描述了带有客户端证书的 TLS。
No it is not possible. There are a number of scenarios where you won't see the real client IP address due to either the actions of the user, or other reasons that are outside the user's control.
In the latter cases, IP-based identification ends up causing head-aches for your honest customers; i.e. the customers that you really want to keep.
If you really need to limit access to specific set of computers, you should consider using something like SSL/TLS with client certificates as your first line of defence. TLS with client certificates is described here.
IP 很容易被伪造，就像电子邮件发送者一样，我强烈建议不要仅仅依赖它们。
IPs can be easily faked like email-senders I would strongly suggest not to rely on them solely.